sulu/sulu

Composer · Package

18 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)CVE-2026-92692 · GHSA-JG26-Q8HG-3PQ4	sulu/sulu	Composer	Medium	Fix reported	2026-09-23
Sulu: Weak Cryptographical usage for API Key generation and Reset TokensCVE-2026-45701 · GHSA-7FV8-6PP7-6H85	sulu/sulu	Composer	Medium	Fix reported	2026-09-10
Sulu grants access to pages regardless of role permissionsCVE-2024-27915 · GHSA-JR83-M233-GG6P	sulu/sulu	Composer	Medium	Fix reported	2026-09-10
Sulu HTML Injection via Autocomplete SuggestionCVE-2024-24807 · GHSA-GFRH-GWQC-63CV	sulu/sulu	Composer	Low	Fix reported	2026-09-10
Sulu Observable Response Discrepancy on Admin LoginCVE-2023-39343 · GHSA-WMWF-49VV-P3MR	sulu/sulu	Composer	Medium	Fix reported	2026-09-10
Sulu: Stored XSS via media download inline-disposition overrideCVE-2026-82396 · GHSA-PP4X-CCXQ-6R33	sulu/sulu	Composer	Medium	Fix reported	2026-09-02
Sulu: Fix authorization bypass when creating preview linksCVE-2026-82394 · GHSA-65CV-W493-7VHQ	sulu/sulu	Composer	Medium	Fix reported	2026-09-02
Sulu: Media move/update authorization bypass (IDOR)CVE-2026-82395 · GHSA-H6CX-GJXX-V25C	sulu/sulu	Composer	Medium	Fix reported	2026-09-02
XSS Injection in Media Collection Title was possibleCVE-2021-32737 · GHSA-GM2X-6475-G9R8	sulu/sulu	Composer	Medium	Fix reported	2026-07-08
Privilege escalation in the Sulu Admin panelCVE-2021-43835 · GHSA-84PX-Q68R-2FC9	sulu/sulu	Composer	High	Fix reported	2026-07-08
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/suluCVE-2021-41169 · GHSA-H58V-G3Q6-Q9FX	sulu/sulu	Composer	Medium	Fix reported	2026-07-08
PHP file inclusion in the Sulu admin panelCVE-2021-43836 · GHSA-VX6J-PJRH-VGJH	sulu/sulu	Composer	High	Fix reported	2026-07-08
Reset Password / Login vulnerability in SuluCVE-2020-15132 · GHSA-WFM4-PQ59-WG6R	sulu/sulu	Composer	Medium	Fix reported	2026-07-08
Sulu: Used API Keys may be available via Admin APIGHSA-9M6V-8FXC-4R44	sulu/sulu	Composer	Low	Fix reported	2026-05-18
Sulu checks fix permissions for subentities endpointsCVE-2026-34372 · GHSA-6H7H-M7P5-HJQP	sulu/sulu	Composer	Medium	Fix reported	2026-04-01
Sulu vulnerable to XXE in SVG File upload InspectorCVE-2025-47778 · GHSA-F6RX-HF55-4255	sulu/sulu	Composer	Medium	Fix reported	2025-05-15
Cross-site Scripting via uploaded SVGCVE-2024-47618 · GHSA-255W-87RH-RG44	sulu/sulu	Composer	Medium	Fix reported	2024-10-18
Injection of arbitrary HTML/JavaScript code through the media download URLCVE-2024-47617 · GHSA-6784-9C82-VR85	sulu/sulu	Composer	Medium	Fix reported	2024-10-17